CIIP Healthcare Information Security and Privacy 2

Question 1

What is the maximum number of days a covered entity has to notify affected individuals after discovering a HIPAA breach?

Accepted Answer

60 days

Answer

HIPAA requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI.

Question 2

Which DICOM attribute must be removed to properly de-identify an image per DICOM PS3.15 standard?

Accepted Answer

Patient Name (0010,0010)

Answer

Patient Name (0010,0010) is a core identifying attribute that must be removed or anonymized per DICOM de-identification profiles.

Question 3

A Business Associate Agreement (BAA) is required when a PACS vendor:

Accepted Answer

Has access to ePHI while providing services to a covered entity

Answer

A BAA is legally required whenever a business associate handles, stores, or transmits ePHI on behalf of a covered entity.

Question 4

Which type of audit log is most critical for detecting unauthorized access to imaging studies in a PACS environment?

Accepted Answer

Access audit log tracking user logins and study views

Answer

Access audit logs record who viewed or accessed specific studies and are essential for detecting unauthorized PHI access in PACS.

Question 5

What does the principle of 'minimum necessary' require in an imaging informatics context?

Accepted Answer

Staff should access only the PHI needed to perform their specific job duties

Answer

The minimum necessary principle requires limiting PHI access and disclosure to what is reasonably needed to accomplish the intended purpose.

CIIP - Certified Imaging Informatics Professional Practice Test